Privacy Policy
Last updated: August 24, 2026
1. Who we are
Last Site Standing ("the Arena", "we", "us") is operated by SmartBotCrafters S.à r.l.-s, RCS Luxembourg B283.863, Wormeldange, Grand Duchy of Luxembourg (sbc.lu), acting as the data controller within the meaning of the EU General Data Protection Regulation (GDPR). Contact: privacy@lastsitestanding.lol.
2. What we collect and why
What you give us when joining: your site URL, a display name, and optionally your X/Twitter handle. Purpose: running the competition (public leaderboard, public site cards). Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR) — the game cannot work without it. You have no user account; we store no name, email, or credentials for fighters.
Click attribution: every arena-link click stores a salted hash of the visitor's IP address plus an hourly bucket. We cannot reverse the hash into an IP address, and the daily-rotating salt means old hashes cannot be linked across days. Purpose: preventing duplicate click fraud so the leaderboard stays fair. Legal basis: legitimate interest (Art. 6(1)(f)) in protecting the integrity of the game.
Aggregate traffic metrics: we count board views and arena clicks per day in aggregate to set advertising prices. These counters contain no personal data.
Purchases (Black Market / sponsor slots): payments are processed by our payment provider Dodo Payments as an independent controller; they receive your email address and billing country for receipt and tax purposes. We store only the payment reference ID, the purchased item, and — for sponsors — the ad content (site URL, ad name) and the description automatically fetched from your website's own metadata. Legal basis: contract performance.
3. What we do NOT do
No accounts or passwords. No tracking cookies or analytics profiles. No advertising trackers. No selling of personal data — there is almost no personal data to sell. No emails unless you buy something (receipt comes from the payment provider).
4. Processors & third parties
Hosting & database: Cloudflare (Workers, D1) — EU/EEA edge processing. Payments: Dodo Payments. Favicons are loaded from Google's public favicon service based on the site URL you list; this requests the icon for that domain only. A current list is available on request.
5. Retention
Listings persist while their owners keep them alive or until the operator removes them. Click records (salted hashes) are deleted after 90 days. Payment references are kept as long as tax law requires (currently 10 years under Luxembourg law, invoice data only).
6. Your rights
Under GDPR you may request access, rectification, erasure, restriction, and portability of your personal data, and object to processing. Since fighters are identified only by their secret dashboard link and site URL, exercise any right by emailing privacy@lastsitestanding.lol from a contact we can verify against your listing (e.g. publish a verification token on your listed site). You may also lodge a complaint with the CNPD (Commission Nationale pour la Protection des Données, Luxembourg).
7. Children
The Arena is not directed at children under 16 and we do not knowingly process their data.